VYPR
← All advisories
High severityNVD Advisory· Published Nov 21, 2014· Updated Jun 17, 2026

CVE-2014-8682

CVE-2014-8682

Description

Multiple SQL injection vulnerabilities in Gogs (aka Go Git Service) 0.3.1-9 through 0.5.x before 0.5.6.1105 Beta allow remote attackers to execute arbitrary SQL commands via the q parameter to (1) api/v1/repos/search, which is not properly handled in models/repo.go, or (2) api/v1/users/search, which is not properly handled in models/user.go.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
gogs.io/gogsGo
>= 0.3.1, < 0.5.80.5.8

Affected products

7
  • Gogs/Gogs6 versions
    cpe:2.3:a:gogits:gogs:*:*:*:*:*:*:*:*+ 5 more
    • cpe:2.3:a:gogits:gogs:*:*:*:*:*:*:*:*range: <=0.5.5
    • cpe:2.3:a:gogits:gogs:0.3.1-9:*:*:*:*:*:*:*
    • cpe:2.3:a:gogits:gogs:0.4.1:*:*:*:*:*:*:*
    • cpe:2.3:a:gogits:gogs:0.4.2:*:*:*:*:*:*:*
    • cpe:2.3:a:gogits:gogs:0.5.0:*:*:*:*:*:*:*
    • cpe:2.3:a:gogits:gogs:0.5.2:*:*:*:*:*:*:*
  • ghsa-coords
    pkg:golang/gogs.io/gogs
    Range: >= 0.3.1, < 0.5.8

Patches

Vulnerability mechanics

References

14

News mentions

0

No linked articles in our index yet.